Skip to content
CommonLayer
Documentation menu
On this page

ADR-0037: A second person confirms high-impact not_affected statements

Status: Accepted (WP-70a; threat model O5). Implemented in crates/commonlayer-security/src/service/confirmations.rs, src/service/triage.rs and migrations/0015_assessment_confirmation.sql.

Context

A maintainer could close a critical finding alone by declaring it not_affected (manually or by importing an OpenVEX document). The statement is public and audited, but a single mistaken or dishonest assessment removed the finding from deadlines, the scan gate and the project's security state.

Decision

  • A not_affected statement about a finding whose effective severity (KEV escalation included) is at or above security.not_affected_confirmation_min_severity (default high) is stored as pending. While pending it covers nothing: the finding stays acknowledged, its deadlines run, the scan gate still blocks, and the statement is not published in the project's OpenVEX document.
  • A second person with triage rights on the project confirms or rejects it (POST /api/v1/security/assessments/{id}/confirm, …/reject with a note). The author can never decide: service check, audited denial, and a database CHECK (decider ≠ author). Deciding requires a person (ADR-0035).
  • Statements requested by service accounts or system actors record no author, so any person with triage rights may confirm them. For statements about vulnerabilities without a finding, the vulnerability's own severity decides.
  • The threshold is a runtime setting (ADR-0038).

Consequences

  • One person can no longer close a high or critical finding by assessment. Below the threshold one triager still decides; the statement is public and audited (threat model O5 residual).
  • Projects with a single active maintainer need a second person with triage rights (for example a security_reviewer assignment) before a high-impact not_affected can take effect.
  • Events security.assessment.confirmation_requested and …confirmation_decided notify the people who can act. The portal shows pending statements on the project security page and the maintainer findings page (WP-70e); the author sees the rule instead of the buttons.
  • Tests: confirmations::* (including the runtime-setting threshold), vex::*; the Playwright spec wiring.spec.ts covers the confirm flow in a browser.